Limit Web App Access To Specific Organizations

Question

I'm relatively new to web development and security and I'm looking to limit the access to my web app to specific companies (and/or IP addresses).

Authentication at the user level via username and password is not an option. I could set up a firewall and only allow traffic from certain IP addresses, but this doesn't seem like the most secure solution since someone could just spoof the IP.

Is there an auth pattern that would be able to handle this case? The end result would have all users belonging to a given organization having access to the app. Use a certificate or something like that?

Answer 1

IP Spoofing is hard. Very, very hard. You can hardly send a couple bytes on a simple protocol using IP spoofing, let alone requiring an answer/response.

Imagine talking to someone, but only being able to speak to them, and not listen to them. IP Spoofing is like that. You must predict all their answers (on protocol level) and give credible answers without ever receiving anything from them. It's not easy at all.

Your main problem is not that is easy to spoof IP (it is not), but that is easy to attack someone at those companies and use their computers as a proxy. A phishing email will end up with someone there executing a program from someone outside, and create a tunnel between the attacker and your application. Unlikely, but way more likely than a IP spoof.

You can safely use an IP whitelist, and only allow people from that list. Usually companies will have a gateway server (and proxy, and IPS/IDS, and virus scanner all in one) and every request will come from this gateway. So it's simple to create such a list.

You said login/password is not an option. Why?